From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=fail (p=none dis=none) header.from=gmail.com Received: from mail-dy1-x1334.google.com (mail-dy1-x1334.google.com [IPv6:2607:f8b0:4864:20::1334]) by passt.top (Postfix) with ESMTPS id CC5F05A0275 for ; Fri, 13 Nov 2026 12:21:21 +0100 (CET) Received: by mail-dy1-x1334.google.com with SMTP id 5a478bee46e88-36eb1cb7aabso1032768eec.0 for ; Fri, 13 Nov 2026 03:21:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794568880; x=1795173680; darn=passt.top; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=i0mdlyE/9VpMPUNLxWSp4LHaC9/CBWfykQ/0wXxsfF4=; b=S89sepZ8RPSBGAtDhAuH2IcYgQfY7tPPbWPn8O6sQHWAQl+ZE76jcFuOQC6USKJGoe a6fKD0N3jNK1F6bLuobPi8tS8O8+t7LL3XqRoVrshfno9B8+T6uUZmC4TCzHfCff1Gob 1rnxd36eG5YA7G7Bj1aYNeU09+FwqNrvdcFqjXDaxfmodZPB6C4aezuz8B9wOPNMMzMZ NCVKNstxYiS9JYBxKikixoVCkvWEQ1sgjU6Gn0kCqzwIiwgVBIUEssV9BIWllrOObbpE 4tCivEhk4F0KNsj4FEMd8RMREhRG8S9RB+rGg0N7dO0DlCRs7wm97r+EV4LIb7t4r8Xr xWcA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794568880; x=1795173680; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=i0mdlyE/9VpMPUNLxWSp4LHaC9/CBWfykQ/0wXxsfF4=; b=D85YOBfJaJ9w9OFXlSCQC3g2RDRikeZXcxDgn7eP8nSREQe8B2jqMeK2BkN/K0W2ch AV6InBsRVzLjMR+MDYz8kuSZjzjHC9eTpXISb/QalAmgzznQlO6ZDn12glLx17ujr/Iq oKjVnAwUcgPu+CQgH77HNvG4xrBIC3FurdUHkGiUSb+twwdl+Gu9L0eA6XmyZwkscKzY vFPOKgEhFk3Qiq/rieEYB4smwoUD7EgzYgDukfW180TDUC+hlX5Fzju+wZRcXEZyGs02 L4sgMkzPJTSlVe6OeKdkDGRra/IRBpe1gd6EXus8crRgPxRDtwOymRZtvZcrDrobvK3D EQnw== X-Gm-Message-State: APuU4Z8keB1i35uEBjcupFEUpehIeeOhGnn03eyb0QvER6w9cLh7dGDL hiqK7uA3Am1lWG/vfmGekp1mdtHaS46+HCpNG3tCzC4vtzkWWGxfA2SMiZYXIbVK X-Gm-Gg: AYBFou3zBRaAW5MdfLl3i2DJR5rzvW8FhzrEsJB9IKHlvz3fqOxnyc2S6F4QTAIssyG rTZZKeW8blOe4LnlZQoGU/E+YPGpEEmLznmOjANWAOBxbbIp+y0MgQb9sAvu1dRFbK7tkWaPHxH R2mkGJaGN2tDob1sqLBMBMAqZM8Mhcbcs1qokVQlSoIj4DuqeIRMjKuCV5AaPbjcugMPWXWNXiR p6As6NyRnD/lLGKOJkEa1jNWNTfAeUSGvZ11tNUU52XorY8i8djqp6aPOeP9jNzMiUgA5e3WMWe o4lxCOR67dNOsIsW3h6MZjtRSI6k7aQ2/Ih1jF204SC06nx/ORtqTf35X2ALwOOvRCgMU1B9C5K oQSTkeRTKRtKx/Gj12fB8zzFMjZkC5HcCACB53noFgJD1Yi2SyQjhhGVlDbiOuyE4EYTZBqRB8r +r3/ljngzdxyeTOd6ovYoEq/FQPDVnRmGdEKvIVRBhG7Yv0rYMmk4F5S9yB4foy1UPm+FvYgCYm TWcP8/J5/g+RCZMcrfzcjC+eHooWa8oxEVNSPvJbP79bGAhuu83LRegyjgYWfkja8G/rXTG2ToY pC+37bontR3QQL74Cvo/wsYchOeuALjLifypAQDy+R+RzCAe5VOIOfcY92I+z9WK5b+4XFcmhLX do4y4/bg= X-Received: by 2002:a05:7301:e2e:b0:376:40db:faec with SMTP id 5a478bee46e88-3796676fd14mr1583279eec.10.1794568879853; Fri, 13 Nov 2026 03:21:19 -0800 (PST) Received: from localhost ([2405:201:7:7:2843:7bd:92d7:9f87]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-379563df84fsm12598764eec.20.2026.11.13.03.21.17 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Fri, 13 Nov 2026 03:21:19 -0800 (PST) From: Aditya Merchant To: passt-dev@passt.top Subject: [PATCH v2 0/2] Follow changes to the host nameserver for DNS forwarding Date: Fri, 13 Nov 2026 16:51:12 +0530 Message-ID: <20261113112114.38764-1-adityamerchant08@gmail.com> X-Mailer: git-send-email 2.50.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-MailFrom: adityamerchant08@gmail.com X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation Message-ID-Hash: PWX3RRIGCEEBYV5NLIOVIIU2RLOAEVMY X-Message-ID-Hash: PWX3RRIGCEEBYV5NLIOVIIU2RLOAEVMY X-Mailman-Approved-At: Fri, 13 Nov 2026 14:07:19 +0100 CC: Stefano Brivio , David Gibson , Paul Holzinger X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Patch 1/2 is v2 of "conf: Follow changes to the host nameserver used for DNS forwarding", reworked after Stefano's review. Patch 2/2 terminates the inotify buffer in pasta_netns_quit_inotify_handler() as well, as also pointed out there. v2: - Only follow a file called resolv.conf, or a link to one, and never open anything else through the copy of its directory: the name is now fixed, not kept in struct ctx (Stefano) - Don't follow changes if we can't make the copy read-only, which needs Linux 5.12, instead of going on with a writable copy (Stefano) - Never copy the root directory, if resolv.conf turns out to be there - Terminate the inotify buffer, and stop at the first relevant event or at an overflow (Stefano) - SELinux: allow watching /etc, and the directories NetworkManager and systemd-resolved use under /run (Stefano) - AppArmor: a single rule for the locations under /run, as we don't follow stub-resolv.conf anymore - Add test/pasta_options/dns_host_follow (Stefano) - Rebase on current master Tested on Kali (arm64, Linux 7.1), with the AppArmor profile enforcing. With pasta alone, these changes are followed: resolv.conf replaced by rename, rewritten in place, empty at start and filled in later, and as a link into /run/resolvconf or /run/systemd/resolve. With --dns-host, or with a link to stub-resolv.conf, the address stays fixed, as expected. With rootless Podman 5.8.6 and a bridge network, container DNS keeps working after the host switches nameserver (it fails with the current Debian package). The new test passes, and fails without patch 1/2. If mount_setattr() fails (I faked that), pasta doesn't follow changes and says so in a debug message. pasta still exits when the namespace file it watches is removed. 'make cppcheck' and 'make clang-tidy' pass. The SELinux module builds against Fedora 45's policy, but I couldn't try it with SELinux enforcing. Aditya Merchant (2): conf: Follow changes to the host nameserver used for DNS forwarding pasta: Terminate inotify buffer, skip nameless events in netns watch conf.c | 259 ++++++++++++++++++++++++++-- conf.h | 2 + contrib/apparmor/abstractions/pasta | 4 + contrib/selinux/pasta.te | 4 + epoll_type.h | 2 + isolation.c | 6 +- isolation.h | 2 +- linux_dep.h | 30 ++++ passt.1 | 5 +- passt.c | 5 + passt.h | 7 + pasta.c | 5 +- test/pasta_options/dns_host_follow | 28 +++ test/run | 1 + 14 files changed, 346 insertions(+), 14 deletions(-) create mode 100644 test/pasta_options/dns_host_follow -- 2.50.1 (Apple Git-155)